Compliance in Practice, Part 1 - The Compliance Monitoring Plan
Ask why your credit union tested Reg E disputes this quarter but not flood insurance, and you’ll usually hear one of two answers: “That’s what was on the calendar,” or “That’s what we had time for.” That’s true whether the answer comes from a dedicated Compliance Officer or the person who inherited compliance along with three other job descriptions.
Both answers are honest. Neither one holds up well when a board member asks the follow-up question, or when a member is the one who finds the problem first.
For a small team, the hard truth is simple. If you try to test everything equally, nothing gets tested well. A monitoring plan that gives equal weight to every regulation spreads limited time thin, and the areas most likely to hurt members get the same quick look as the ones that rarely change.
A good monitoring plan sets priorities on purpose. It shows where you look first, why you chose those areas, and what happens when you find a problem. That reasoning is what makes the plan defensible.
Start With Risk, Not the Rulebook
Don't start with a list of regulations. Start with your actual operations: the products you offer, the processes behind them, and the people and systems that run them. Then rate each area on five practical factors:
Volume: How much activity moves through it?
Complexity: How many steps, systems, handoffs, or manual calculations are involved?
Member impact: If something goes wrong, does a member lose money, get the wrong disclosure, or get treated unfairly?
Recent change: Has anything changed, such as a new product, vendor, core system, staff member, or regulation?
History: Have audits, exams, complaints, or past reviews found problems here?
A simple 1 to 3 scale is enough. Next, ask how strong your controls are. An area with high inherent risk and solid, tested controls may need less attention than a moderate area that depends on one experienced employee and a checklist nobody has updated in years. What drives your plan is the risk that remains after your controls, not the risk on paper.
Let Risk Drive Frequency
Once each area has a residual rating, tie review frequency to it:
High risk: quarterly or semiannual reviews
Moderate risk: annual reviews
Low risk: rotating coverage, often every 18 to 24 months
Adjust these tiers to fit your size and staffing. Once you set them, stick to them. Don't let a low-risk area slide to "someday," and don't let a high-risk area quietly drop to once a year because the calendar got crowded. If you change the schedule, write down why.
Build in triggers that move an area up regardless of the calendar: a new product launch, a vendor conversion, a jump in complaints, key staff turnover, or a new regulatory requirement. A plan that changes only once a year will miss the moments that carry the most risk.
Test Transactions, Not Just Procedures
Reading a procedure tells you how a process should work. Testing transactions tells you how it actually works. Both matter, but only transaction testing shows whether members are getting the right disclosure, the right rate, the right timeline, and the right outcome.
Before each review, decide:
What population you are testing, such as all consumer loans closed last quarter
What period it covers
What attributes you will check on each item
What counts as an exception
Settling these questions up front keeps the review focused and makes your conclusions easier to support.
Sample With a Reason
Small credit unions rarely need statistical sampling, but they do need a sampling approach they can explain. Scale sample size to risk. A high-risk area with heavy volume deserves a larger sample than a low-risk area with a few transactions a month. Combine random selection with a few targeted picks, such as a new employee's work, unusual transactions, or items close to a deadline.
Most important, write down how you chose the sample. "We pulled 25 loans at random from the 312 closed in the second quarter, plus 5 originated by our newest loan officer" is a conclusion someone can follow. "We looked at some files" is not.
Treat Exceptions as Information
An exception is not automatically a failure, and it is not automatically minor. Ask three questions each time:
Is it isolated or systemic? One missed signature is different from the same error across a branch.
What caused it? Training, a system setting, an unclear procedure, or workload pressure each call for a different fix.
Did it affect members? If so, find out whether others were affected and whether remediation is owed.
When exceptions show up, expand the sample before you draw conclusions. A small sample that turns up problems is a signal to look further, not a final answer.
Know When and Where to Escalate
Decide before reviews begin which findings go where. Routine exceptions may stay with the department manager and a corrective-action date. Repeated, systemic, or member-impacting findings should go to senior management. Significant or unresolved issues belong in reporting to the board or the appropriate committee.
Track each finding to closure with an owner, a target date, and evidence that the fix worked. Then schedule a follow-up test. A finding marked "resolved" with no retest is an assumption, not a conclusion.
Keep It Proportionate
A defensible monitoring plan doesn't need to be long. It needs to show that you looked at your risks honestly, put your limited time where it matters most, tested real activity, and acted on what you found. For a small credit union, that kind of focus beats an ambitious calendar nobody can keep.
Bottom Line
You don't have to test everything equally. You do have to know why you're testing what you test, and be able to show it. Rank your risks, match your review frequency to them, sample with a reason, and follow every exception to resolution.
Crimson Oak Strategies provides strategic compliance support and guidance tailored to credit unions. Our mission is simple: To make compliance practical. Contact us to learn how we can help.
